REMARKS 
Interview Summary 

Applicants' representative and the Examiner conducted an interview on October 15, 2007 
to discuss the pending claims and cited references. During the interview, Applicants' 
representative explained the distinctions between the claimed invention and the cited references. 
The Examiner, in turn, requested more precise citations to the portions of the specification that 
support the claims. Agreement as to the merits of the rejections was not reached. 

Objection to the Specification / 35 U.S.C. § 112 Rejection 

The specification is objected to as allegedly failing to provide proper antecedent basis for 
the claimed subject matter. Specifically, the Examiner asserts that the specification fails to 
provide proper antecedent basis for the phrase "the computer code is determined to be executable 
only when the computer code is time stamped..." as recited in claim 8. Additionally, claim 8 is 
rejected under § 1 12, first paragraph, because the claim allegedly contains subject matter which 
was not described in the specification in such a way as to reasonably convey to one skilled in the 
relevant art that the inventors, at the time the application was filed, had possession of the claimed 
invention. Applicants respectfully traverse the objection and rejection. 

Claim 1, as originally filed in the application, recited a series of steps concluded by: 

determining the executability of the computer content in response to the result of the 
comparing step. 

Claim 8, as originally filed, recited "wherein the computer content is executed only when the 
computer content is. . ." In the response filed July 25, 2007, claim 8 was amended to recite "the 
computer code is determined to be executable..." (emphasis added to all claims to emphasize 
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claim language under discussion). Thus, claim 8 was amended merely to conform it with the 
originally-filed claim 1 . 

The claims as filed in the original specification are part of the disclosure. In re Benno, 
768 F.2d 1340 (Fed. Cir. 1985). The original language of claim 1 therefore provides antecedent 
basis for amended claim 8 and shows that the subject matter of claim 8 was described in the 
specification in a way that demonstrates that the inventors had possession of the claimed 
invention. Moreover, there is ample support in the specification for claim 8. For example, 
paragraph 75 states that "access control module 203 applies alert time 204 to determine the 
executability of the computer code." FIG. 4 likewise illustrates steps associated with 
determining the executability of the computer code. For at least these reasons, Applicants 
respectfully traverse the objection to and rejection of claim 8. 

Claim Rejections under 35 U.S.C. § 103 

Claims 1-10, 12-17, and 20-33 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over Bates et al., U.S. Patent 6,721,721 in view of Hericourt et al., U.S. Patent 
7,099,916. Claim 1 1 stands rejected as being unpatentable over the combination of Bates and 
Hericourt in view of Symantec, "Norton Antivirus Corporate Edition." Applicants respectfully 
traverse these rejections as applied to the amended claims. 

The claimed invention uses a virus outbreak report indicating a virus attack to compute a 
computer virus alert time. The computer virus alert time is compared with a time stamp 
corresponding to an earliest moment computer code was allowed to execute on a computer 
coupled to a computer network, and the executability of the computer code is determined in 

App. No. 10/046,496 - 12 - 

20423/05957/DOCS/181 1804.1 



response to the comparison. Specifically, the independent claims recite limitations 
corresponding to: 

entering a first computer vims status mode in response to a first computer virus 
outbreak report indicating a virus attack threat to a computer network; 

computing a first computer virus alert time corresponding to entry into the first 
computer virus status mode; 

comparing a time stamp of executable computer code corresponding to an earliest 
moment the computer code was allowed to execute on a computer coupled to 
the computer network with the first computer virus alert time; and 

determining the executability of the computer code in response to the result of the 
comparing step. 

(quoting from claim 1). Dependent claim 8 further recites that the "computer code is determined 
to be executable only when the computer code is time stamped prior to the first computer virus 
alert time." In other words, the computer code is executable because it has existed since before 
the virus alert and, therefore, is unlikely to be infected by that virus. 

Support for the amended claims is found throughout the specification and figures. FIG. 1 
illustrates a computer network having coupled computers. Paragraph 38 states that the "time 
stamp of an executable computer code corresponds to an earliest moment this particular 
computer code was allowed to execute by computers 2,3 on the network." Further, paragraph 50 
states that "memory table 205 stores hash values of computer codes that have been executed and 
a time entry recording the time of inserting the hash value into memory table 205." Paragraph 75 
describes how the access control module 203 assumes that computer code requesting execution 
has never been allowed to execute if the code's hash value is not found in the memory table. 

The cited references, at the least, fail to disclose "comparing a time 

stamp. . .corresponding to an earliest moment the computer code was allowed to execute on a 
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computer coupled to the computer network." Bates discloses a system that integrates virus 
checking functionality into a computer database search environment, thereby allegedly 
decreasing the risks of viruses associated with accessing search results from computer database 
searches. See Bates, Abstract; column 3, lines 1-3. 

The Examiner asserts that Bates "discloses that a time stamp of the executable code 
corresponds, inter alia, to the time the code was virus scanned" but does not explicitly disclose 
that the time stamp corresponds to an execution time of the computer code. The Examiner 
addresses this lack of disclosure by citing to Hericourt, which allegedly discloses that virus 
scanning of executable code can comprises an execution of the code. Therefore, the Examiner 
alleges, it would have been obvious to one of ordinary skill in the art to recognize the teachings 
of Hericourt within the system of Bates. 

Neither Bates nor Hericourt discloses or suggests using a time stamp that corresponds to 
an earliest moment the computer code was allowed to execute on a computer coupled to a 
computer network. Thus, even if Bates discloses a time stamp indicating when code was virus 
scanned, and the scanning comprised an execution as allegedly taught by Hericourt, there is no 
teaching or suggestion that the time stamp corresponds to an earliest time that the code was 
scanned or executed. Both references assume that code is scanned multiple times, and neither 
reference attaches any special significance to an earliest time that the code was scanned (or 
executed). Rather, the time stamp in the references might well be the latest time the code was 
scanned or executed. 

The Symantec reference fails to remedy the deficiencies of Bates and Hericourt described 
above. Therefore, a person of ordinary skill in the art, considering the teachings of the 
references either alone or in combination would not find the claimed invention obvious. 
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In the "Responses to Arguments" section of the October 3, 2007 Office Action, the 
Examiner did not directly address the arguments raised above. Instead, the Examiner stated that 
the claims recited "an earliest moment the computer code was allowed to execute" while 
Applicants' Remarks used the language "the earliest moment. . ." Therefore, the Examiner 
asserted that the argued language was not present in the amended claims. 

In response, Applicants have revised the above Remarks to use "an" instead of "the," 
thereby conforming the claims with the Remarks and addressing the Examiner's concerns. In 
addition, Applicants have added additional language to the claims that clarifies that the execution 
under consideration occurs on a computer coupled to the computer network. Applicants 
respectfully submit that the features upon which Applicants rely in the Remarks are found in the 
amended claims. 

Accordingly, Applicants respectfully submit that the pending claims are allowable over 
the cited references and request allowance of the claims. If the Examiner believes that direct 
contact with the Applicants' attorney will advance the prosecution of this case, the Examiner is 
encouraged to contact the undersigned as indicated below. 
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Respectfully submitted, 

CAREY S. NACHENBERG, ET AL. 



Dated: October 23, 2007 



By: /Brian Hoffman/ 

Brian M. Hoffman, Reg. No. 39,713 
Attorney for Applicants 
Fenwick & West LLP 
801 California Street 
Mountain View, CA 94041 
Tel.: (415) 875-2484 
Fax: (415)281-1350 
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